Weekly spam summary on May 20th, 2006
May 21, 2006
This week we:
Nothing went wrong this week, thank goodness; no reboots, no SMTP frontend restarts, nothing. Weekly volume seems to be back to the normal level when things are quiet; there's no sign of last week's Sunday spike. The per-day statistics are sufficiently boring and flat (peaking at 20,000 connections on Wednesday) that I'm not going to put them in.
Kernel level packet filtering top ten:
Host/Mask Packets Bytes 22.214.171.124 11876 570K 126.96.36.199 4672 224K 188.8.131.52/24 4390 219K 184.108.40.206/10 3781 190K 220.127.116.11 2925 149K 18.104.22.168/11 2583 131K 22.214.171.124/11 2449 122K 126.96.36.199/12 2069 104K 188.8.131.52 2027 94761 184.108.40.206/13 1909 94116
This is very similar to last week's numbers, down to the first place finisher.
Connection time rejection stats:
35861 total 17407 dynamic IP 14992 bad or no reverse DNS 2390 class bl-cbl 278 class bl-dsbl 135 class bl-sdul 81 class bl-njabl 69 class bl-sbl 63 class bl-ordb
Out of curiosity, I took a look at the SBL rejections; the results are kind of depressing. The 69 rejections were of 13 different IP addresses; only two IP addresses (5 rejections total) were not listed for being advance fee fraud sources.
Twelve out of the top 30 most rejected IP addresses were rejected more
than 100 times; the top rejection source was our friend 220.127.116.11
(497 times before it was re-blocked at the kernel level). 26 of the top
30 most rejected IP addresses are currently in the CBL; six of them are
Hotmail is backsliding; perhaps I should be surprised. This week's stats:
The last set of numbers:
Oh well, so much for not getting very many bounces. (I suppose
this still qualifies by other people's standards). As with last
week, (just) over half the bad
* * *
Atom feeds are available; see the bottom of most pages.